Merge pull request #15906 from atorralba/atorralba/java/jdk-neutrals

atorralba · web-flow · commit 30d906d42a80 · 2024-03-14T11:07:06.000+01:00
Java: Add more neutral JDK models
diff --git a/java/ql/lib/ext/java.beans.model.yml b/java/ql/lib/ext/java.beans.model.yml
@@ -4,3 +4,12 @@ extensions:
       extensible: summaryModel
     data:
       - ["java.beans", "XMLDecoder", False, "XMLDecoder", "", "", "Argument[0]", "Argument[this]", "taint", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: neutralModel
+    data:
+      # summary neutrals
+      - ["java.beans", "PropertyEditor", "getAsText", "()", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.beans", "PropertyEditor", "getValue", "()", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.beans", "PropertyEditor", "setAsText", "()", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.beans", "PropertyEditor", "setValue", "()", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
diff --git a/java/ql/lib/ext/java.io.model.yml b/java/ql/lib/ext/java.io.model.yml
@@ -80,7 +80,6 @@ extensions:
       - ["java.io", "File", True, "getName", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
       - ["java.io", "File", True, "getParentFile", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
       - ["java.io", "File", True, "getPath", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
-      - ["java.io", "File", True, "listFiles", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
       - ["java.io", "File", True, "toPath", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
       - ["java.io", "File", True, "toString", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
       - ["java.io", "File", True, "toURI", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
@@ -116,9 +115,12 @@ extensions:
       - ["java.io", "File", "isFile", "()", "summary", "manual"]
       - ["java.io", "File", "length", "()", "summary", "manual"]
       - ["java.io", "File", "isDirectory", "()", "summary", "manual"]
+      - ["java.io", "File", "listFiles", "", "summary", "df-manual"]
       - ["java.io", "File", "mkdirs", "()", "summary", "manual"]
       - ["java.io", "FileInputStream", "FileInputStream", "(File)", "summary", "manual"]
+      - ["java.io", "FileInputStream", "FileInputStream", "(String)", "summary", "df-manual"]
       - ["java.io", "InputStream", "close", "()", "summary", "manual"]
+      - ["java.io", "ObjectInput", "readObject", "()", "summary", "df-manual"] # this is a deserialization sink modeled in regular CodeQL
       - ["java.io", "OutputStream", "flush", "()", "summary", "manual"]
       # The below APIs have numeric flow and are currently being stored as neutral models.
       # These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
diff --git a/java/ql/lib/ext/java.net.model.yml b/java/ql/lib/ext/java.net.model.yml
@@ -61,3 +61,10 @@ extensions:
       - ["java.net", "URL", False, "toURI", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
       - ["java.net", "URL", False, "toString", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
       - ["java.net", "URLDecoder", False, "decode", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: neutralModel
+    data:
+      # summary neutrals
+      - ["java.net", "Socket", "getOutputStream", "()", "summary", "df-manual"]
+      - ["java.net", "Socket", "connect", "(SocketAddress,int)", "summary", "df-manual"]
diff --git a/java/ql/lib/ext/java.nio.file.model.yml b/java/ql/lib/ext/java.nio.file.model.yml
@@ -91,6 +91,7 @@ extensions:
     data:
       # summary neutrals
       - ["java.nio.file", "Files", "exists", "(Path,LinkOption[])", "summary", "manual"]
+      - ["java.nio.file", "Files", "newInputStream", "(Path,LinkOption[])", "summary", "df-manual"]
       # sink neutrals
       - ["java.nio.file", "Files", "getLastModifiedTime", "", "sink", "hq-manual"]
       - ["java.nio.file", "Files", "getOwner", "", "sink", "hq-manual"]
diff --git a/java/ql/lib/ext/java.util.logging.yml b/java/ql/lib/ext/java.util.logging.yml
@@ -0,0 +1,8 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: neutralModel
+    data:
+      # summary neutrals
+      - ["java.util.logging", "LogRecord", "getResourceBundle", "()", "summary", "df-manual"]
+      - ["java.util.logging", "LogRecord", "setParameters", "", "summary", "df-manual"]
diff --git a/java/ql/lib/ext/java.util.model.yml b/java/ql/lib/ext/java.util.model.yml
@@ -107,6 +107,8 @@ extensions:
       - ["java.util", "Collections", False, "unmodifiableSortedMap", "(SortedMap)", "", "Argument[0].MapKey", "ReturnValue.MapKey", "value", "manual"]
       - ["java.util", "Collections", False, "unmodifiableSortedMap", "(SortedMap)", "", "Argument[0].MapValue", "ReturnValue.MapValue", "value", "manual"]
       - ["java.util", "Collections", False, "unmodifiableSortedSet", "(SortedSet)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
+      - ["java.util", "ConcurrentHashMap", False, "ConcurrentHashMap", "(Map)", "", "Argument[0].MapKey", "Argument[this].MapKey", "value", "df-manual"]
+      - ["java.util", "ConcurrentHashMap", False, "ConcurrentHashMap", "(Map)", "", "Argument[0].MapValue", "Argument[this].MapValue", "value", "df-manual"]
       - ["java.util", "Deque", True, "addFirst", "(Object)", "", "Argument[0]", "Argument[this].Element", "value", "manual"]
       - ["java.util", "Deque", True, "addLast", "(Object)", "", "Argument[0]", "Argument[this].Element", "value", "manual"]
       - ["java.util", "Deque", True, "descendingIterator", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
@@ -428,6 +430,14 @@ extensions:
       - ["java.util", "Collections", "emptySet", "()", "summary", "manual"]
       - ["java.util", "Collections", "sort", "", "summary", "manual"]
       - ["java.util", "Enumeration", "hasMoreElements", "()", "summary", "manual"]
+      - ["java.util", "EnumSet", "allOf", "(Class)", "summary", "df-manual"]
+      - ["java.util", "EnumSet", "clone", "()", "summary", "df-manual"]
+      - ["java.util", "EnumSet", "complementOf", "(EnumSet)", "summary", "df-manual"]
+      - ["java.util", "EnumSet", "copyOf", "(Collection)", "summary", "df-manual"]
+      - ["java.util", "EnumSet", "copyOf", "(EnumSet)", "summary", "df-manual"]
+      - ["java.util", "EnumSet", "noneOf", "(Class)", "summary", "df-manual"]
+      - ["java.util", "EnumSet", "of", "", "summary", "df-manual"]
+      - ["java.util", "EnumSet", "range", "(Object,Object)", "summary", "df-manual"]
       - ["java.util", "HashMap", "containsKey", "(Object)", "summary", "manual"]
       - ["java.util", "HashMap", "HashMap", "(int)", "summary", "manual"]
       - ["java.util", "HashMap", "size", "()", "summary", "manual"]
@@ -454,6 +464,7 @@ extensions:
       - ["java.util", "Optional", "isEmpty", "()", "summary", "manual"]
       - ["java.util", "Optional", "isPresent", "()", "summary", "manual"]
       - ["java.util", "Random", "nextInt", "(int)", "summary", "manual"]
+      - ["java.util", "ResourceBundle", "getBundle", "", "summary", "df-manual"]
       - ["java.util", "Set", "contains", "(Object)", "summary", "manual"]
       - ["java.util", "Set", "isEmpty", "()", "summary", "manual"]
       - ["java.util", "Set", "size", "()", "summary", "manual"]
diff --git a/java/ql/lib/ext/java.util.prefs.model.yml b/java/ql/lib/ext/java.util.prefs.model.yml
@@ -3,6 +3,21 @@ extensions:
       pack: codeql/java-all
       extensible: neutralModel
     data:
+      # summary neutrals
+      - ["java.util.prefs", "Preferences", "get", "(String,String)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "getBoolean", "(String,boolean)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "getByteArray", "(String,byte[])", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "getDouble", "(String,double)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "getFloat", "(String,float)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "getInt", "(String,int)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "getLong", "(String,int)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "put", "(String,String)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "putBoolean", "(String,boolean)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "putByteArray", "(String,byte[])", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "putDouble", "(String,double)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "putFloat", "(String,float)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "putInt", "(String,int)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+      - ["java.util.prefs", "Preferences", "putLong", "(String,int)", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
       # sink neutrals
       - ["java.util.prefs", "AbstractPreferences", "nodeExists", "", "sink", "hq-manual"]
       - ["java.util.prefs", "Preferences", "nodeExists", "", "sink", "hq-manual"]
diff --git a/java/ql/lib/ext/java.util.regex.model.yml b/java/ql/lib/ext/java.util.regex.model.yml
@@ -30,4 +30,9 @@ extensions:
       pack: codeql/java-all
       extensible: neutralModel
     data:
+      - ["java.util.regex", "Matcher", "appendReplacement", "(StringBuffer,String)", "summary", "df-manual"]
+      - ["java.util.regex", "Matcher", "appendTail", "(StringBuffer)", "summary", "df-manual"]
       - ["java.util.regex", "Matcher", "find", "()", "summary", "manual"]
+      - ["java.util.regex", "Matcher", "pattern", "()", "summary", "df-manual"]
+      - ["java.util.regex", "Pattern", "compile", "(String,int)", "summary", "df-manual"]
+      - ["java.util.regex", "Pattern", "pattern", "()", "summary", "df-manual"]
diff --git a/java/ql/lib/ext/javax.crypto.model.yml b/java/ql/lib/ext/javax.crypto.model.yml
@@ -24,3 +24,5 @@ extensions:
       - ["javax.crypto", "Cipher", "update", "", "summary", "manual"]
       - ["javax.crypto", "Cipher", "updateAAD", "", "summary", "manual"]
       - ["javax.crypto", "Cipher", "wrap", "", "summary", "manual"]
+      - ["javax.crypto", "Mac", "init", "(Key)", "summary", "df-manual"]
+      - ["javax.crypto", "Mac", "doFinal", "()", "summary", "df-manual"]
diff --git a/java/ql/lib/ext/javax.crypto.spec.model.yml b/java/ql/lib/ext/javax.crypto.spec.model.yml
@@ -26,3 +26,8 @@ extensions:
       - ["javax.crypto.spec", "PBEParameterSpec", False, "PBEParameterSpec", "", "", "Argument[0]", "encryption-salt", "manual"]
       - ["javax.crypto.spec", "SecretKeySpec", False, "SecretKeySpec", "(byte[],String)", "", "Argument[0]", "credentials-key", "hq-generated"]
       - ["javax.crypto.spec", "SecretKeySpec", False, "SecretKeySpec", "(byte[],int,int,String)", "", "Argument[0]", "credentials-key", "hq-generated"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: neutralModel
+    data:
+      - ["javax.crypto.spec", "SecretKeySpec", "SecretKeySpec", "(byte[],String)", "summary", "df-manual"]
diff --git a/java/ql/test/ext/TestModels/Test.java b/java/ql/test/ext/TestModels/Test.java
@@ -110,9 +110,6 @@ public void test() throws Exception {
             File f2 = (File)source();
             sink(f2.getPath()); // $hasTaintFlow
 
-            File f3 = (File)source();
-            sink(f3.listFiles()); // $hasTaintFlow
-
             StringWriter sw = (StringWriter)source();
             sink(sw.toString()); // $hasTaintFlow
 
diff --git a/java/ql/test/query-tests/Metrics/GeneratedVsManualCoverage/TopJdkApisTest/TopJdkApis/java/io/File.java b/java/ql/test/query-tests/Metrics/GeneratedVsManualCoverage/TopJdkApisTest/TopJdkApis/java/io/File.java
@@ -16,7 +16,6 @@ protected File() {}
     public File(File p0, String p1){} // manual summary
     public File(String p0){} // manual summary
     public File(String p0, String p1){} // manual summary
-    public File[] listFiles(){ return null; } // manual summary
     public Path toPath(){ return null; } // manual summary
     public String getAbsolutePath(){ return null; } // manual summary
     public String getName(){ return null; } // manual summary
@@ -26,6 +25,7 @@ public File(String p0, String p1){} // manual summary
     public boolean exists(){ return false; } // manual neutral
     public boolean isDirectory(){ return false; } // manual neutral
     public boolean isFile(){ return false; } // manual neutral
+    public File[] listFiles(){ return null; } // manual neutral
     public boolean mkdirs(){ return false; } // manual neutral
     public long length(){ return 0; } // manual neutral
 }
diff --git a/java/ql/test/query-tests/Metrics/GeneratedVsManualCoverage/TopJdkApisTest/TopJdkApisTest.expected b/java/ql/test/query-tests/Metrics/GeneratedVsManualCoverage/TopJdkApisTest/TopJdkApisTest.expected
@@ -1,5 +1,5 @@
 | java.awt | 0 | 0 | 2 | 1 | 3 | 0.6666666666666666 | 0.0 | 0.6666666666666666 | 0.0 | NaN | 0.3333333333333333 |
-| java.io | 0 | 0 | 21 | 15 | 36 | 0.5833333333333334 | 0.0 | 0.5833333333333334 | 0.0 | NaN | 0.4166666666666667 |
+| java.io | 0 | 0 | 20 | 16 | 36 | 0.5555555555555556 | 0.0 | 0.5555555555555556 | 0.0 | NaN | 0.4444444444444444 |
 | java.lang | 0 | 0 | 57 | 88 | 145 | 0.3931034482758621 | 0.0 | 0.3931034482758621 | 0.0 | NaN | 0.6068965517241379 |
 | java.lang.invoke | 0 | 0 | 0 | 1 | 1 | 0.0 | 0.0 | 0.0 | NaN | NaN | 1.0 |
 | java.lang.reflect | 0 | 0 | 0 | 4 | 4 | 0.0 | 0.0 | 0.0 | NaN | NaN | 1.0 |
